elastic / elastic/ai-github-actions

[product-manager-impersonator] Delta-first scheduled audit reports

Open
#1,801 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
11
Forks
16
Avg merge
22h 9m
Merged PRs (30d)
31

Description

## Feature Idea

**Summary:** Add standard `New`, `Still Open`, and `Resolved Since Last Report` sections to scheduled-audit detector issues so maintainers can triage changes instead of re-reading whole reports.

## Why a Customer Would Want This
Teams running recurring detector workflows need high-signal issue updates. Today, maintainers must manually compare a new issue with prior reports to understand what changed, which slows triage and increases alert fatigue.

## Rough Implementation Sketch
- Extend previous-findings collection to include enough metadata for last-report comparison (for example prior issue URLs and creation timestamps, in addition to number/title/state).
- Update the shared scheduled-audit instructions to require three delta sections: **New**, **Still Open**, **Resolved Since Last Report**.
- Add a lightweight matching rule (e.g., normalized finding title + evidence key) so recurring findings can be bucketed consistently.
- Include a backlink to the immediately previous report in each new detector issue.

## Why It Won't Be That Hard
This can be implemented centrally in existing shared scheduled-audit fragments and previous-findings plumbing, so one change improves many detector workflows without modifying each detector independently.

## Evidence
- `.github/workflows/gh-aw-fragments/previous-findings.md:9-15` currently fetches only `number,title,state` into `/tmp/previous-findings.json`, which is sufficient for dedup checks but not delta-style reporting.
- `.github/workflows/gh-aw-fragments/previous-findings.md:20-24` instructs duplicate avoidance only; it does not provide a historical-diff reporting pattern.
- `.github/workflows/gh-aw-scheduled-audit.md:46-50` shows `close-older-issues` defaults to `false`, so teams accumulate report history and would benefit from explicit change summaries.
- `/tmp/previous-findings.json` currently contains a long list of prior Product Manager Impersonator issues, illustrating recurring-report volume where delta-focused triage would help.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/31481520929)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Contributor guide

Open the contributing guide

Research direction

Read .github/workflows/gh-aw-fragments/previous-findings.md and .github/workflows/gh-aw-scheduled-audit.md first, tracing how previous-findings.json is collected and how scheduled-audit instructions use it. Done means recurring detector issues provide New, Still Open, and Resolved Since Last Report sections, apply a consistent finding match, and link to the immediately previous report.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
ci-cd, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.